Tsaaro got CERT-IN Empanelled | MeitY has published the DPDP Rules, 2023.
Tsaaro got CERT-IN Empanelled | MeitY has published the DPDP Rules, 2023.
Tsaaro got CERT-IN Empanelled | MeitY has published the DPDP Rules, 2023.
Tsaaro got CERT-IN Empanelled | MeitY has published the DPDP Rules, 2023.
Back To Home
Research Team (Tsaaro)
India Moves Towards Dedicated AI Regulation as Government Announces Consultation Paper
On October 8, 2026, Union Minister for Electronics and Information Technology Ashwini Vaishnaw announced that the government would release a consultation paper on artificial intelligence regulation within a month. Speaking at an event marking the release of the World Bank's World Development Report 2026, Vaishnaw identified AI safety, deepfakes, and the protection of human interests as central priorities. The consultation is expected to invite stakeholder feedback and form the basis of a regulatory framework governing the development and deployment of AI technologies in India.
The announcement comes amid increasing concerns about the risks associated with advanced AI systems, particularly their ability to generate deceptive content, automate complex activities, and potentially cause harm without adequate human oversight. While India has relied largely on existing legislation and sector-specific regulatory measures to address AI-related risks, the proposed consultation signals a move towards a more coordinated framework.
Why the Proposed Framework Matters
India's current regulatory landscape includes the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and rules governing online intermediaries. However, these instruments do not constitute a comprehensive AI-specific regulatory regime. Increasingly autonomous AI systems raise distinct questions concerning accountability, transparency, and the allocation of responsibility when automated decisions cause harm.
Deepfakes are particularly significant because of their potential to facilitate impersonation, misinformation, fraud, and reputational damage. AI systems capable of independently executing tasks also raise concerns about cybersecurity, access to sensitive information, and the adequacy of existing human oversight mechanisms.
The proposed consultation could provide an opportunity to address these challenges through a more coherent regulatory approach while ensuring that safety requirements do not unnecessarily restrict technological innovation.
Towards a Comprehensive AI Governance Framework
The government's proposal reflects a growing international debate over whether existing laws adequately address the risks posed by advanced AI. The consultation could help clarify the responsibilities of AI developers, deployers and organisations integrating AI into their operations.
Potential areas for consideration include safety assessments, transparency requirements, risk-based oversight, and safeguards against harmful AI-generated content. However, the precise scope of the proposed framework will only become clear once the consultation paper is published.
For businesses operating in India, the announcement is an important indication of the direction of future AI governance. Organizations developing or deploying AI technologies may need to consider how their existing compliance, cybersecurity, and accountability mechanisms would align with possible regulatory expectations.
News of the Week
Norway Proposes Restrictions on AI Smart Glasses Over Privacy and Surveillance Concerns
On October 8, 2026, Norway outlined proposals to restrict AI-enabled smart glasses in sensitive public environments, including schools, healthcare facilities and changing rooms, amid concerns over unauthorised recording and surveillance. Digitalisation Minister Torgeir Micaelsen proposed temporary restrictions while an expert group develops longer-term regulatory recommendations. The initiative responds to the growing capabilities of wearable devices that combine cameras, artificial intelligence and potentially facial recognition technologies, allowing users to capture and process information about individuals without their knowledge. The proposal raises important questions regarding meaningful consent, biometric data processing and the protection of individuals in spaces where privacy expectations are particularly high. Norway's approach could influence wider European discussions about whether existing data protection requirements adequately address the surveillance risks posed by increasingly discreet, AI-powered consumer devices.
Source: https://apnews.com/article/norway-ai-glasses-ban-be20dbd949ce058023864b66219f9c2b
EU Defends AI Act as Adequate to Address Risks from Rogue AI Systems
On October 9, 2026, European Commission Executive Vice-President Henna Virkkunen defended the European Union's AI Act, stating that its existing safeguards are capable of addressing risks posed by increasingly autonomous and potentially uncontrollable AI systems. Speaking to Reuters, Virkkunen emphasised that the legislation adopts a risk-based approach covering the lifecycle of AI models, including safety evaluations, expert assessments and continuing monitoring. Her remarks follow growing international concerns about the behaviour of advanced AI systems and whether existing regulatory frameworks can adequately govern their increasing autonomy. The European Commission has also sought information from more than 30 AI companies regarding their safety, security, transparency and copyright compliance practices, with potential investigations carrying substantial financial penalties. The development reinforces the EU's position that existing regulatory mechanisms can respond to emerging AI risks without requiring an entirely new legislative framework..
MeitY Clarifies Consent and Data Audit Requirements Under DPDP Act
On October 5, 2026, the Ministry of Electronics and Information Technology issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, introducing two textual clarifications to the Digital Personal Data Protection Act, 2023. Issued under Section 43(1), the Order amends Section 9(1) to clarify that verifiable consent requirements apply to the personal data of a child or of a person with disability who has a lawful guardian. It also substitutes the expression “periodic audit” with “periodic data audit” in Section 10(2)(c)(ii), aligning the provision with the independent data audit requirements applicable to Significant Data Fiduciaries. The amendments address ambiguities in the statutory language without introducing new compliance obligations or changing the commencement dates of the affected provisions. The clarification is particularly relevant to organisations preparing for the implementation of India's data protection framework, including those processing children's personal data and entities potentially subject to enhanced audit obligations.
Want to Know More?
Reach out to the experts at Tsaaro today.